--- title: ShinyHunters claims yet another Salesforce customers breach description: ShinyHunters claims to have stolen data from roughly 100 high-profile companies including Salesforce, Snowflake, Okta, LastPass, Sony, and AMD by exploiting... canonical: https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ShinyHunters claims yet another Salesforce customers breach | daily.dev og:description: ShinyHunters claims to have stolen data from roughly 100 high-profile companies including Salesforce, Snowflake, Okta, LastPass, Sony, and AMD by exploiting... og:url: https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi og:image: https://api.daily.dev/og/posts/zDm1mXQdI.png og:image:alt: ShinyHunters claims yet another Salesforce customers breach og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ShinyHunters claims yet another Salesforce customers breach **[The Register](https://daily.dev/sources/theregister)** · 5 min read · 0 upvotes · 0 comments ## Summary ShinyHunters claims to have stolen data from roughly 100 high-profile companies including Salesforce, Snowflake, Okta, LastPass, Sony, and AMD by exploiting misconfigured guest user profiles on Salesforce Experience Cloud sites. The attackers modified AuraInspector, an open source tool originally developed by Mandiant to help admins detect Salesforce misconfigurations, turning it into an exploitation tool that bypasses guest user limits and exfiltrates CRM object records. Salesforce clarifies the issue stems from overly permissive guest user profile configurations rather than a platform vulnerability, and recommends customers audit guest user permissions, enforce least-privilege access, disable public API access for guest users, and set default external access to private. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Mandiant plugs Salesforce leaks with open source tool](https://daily.dev/posts/mandiant-plugs-salesforce-leaks-with-open-source-tool-fqroefijv) · The Register · 0 upvotes · 0 comments - [ShinyHunters breached 100\+ companies through an unpatched Oracle PeopleSoft zero-day](https://daily.dev/posts/shinyhunters-breached-100-companies-through-an-unpatched-oracle-peoplesoft-zero-day-n7snkx2k0) · The Next Web · 0 upvotes · 0 comments - [AuraInspector: Auditing Salesforce Aura for Data Exposure](https://daily.dev/posts/aurainspector-auditing-salesforce-aura-for-data-exposure-ewk2rh2hz) · Google Cloud · 0 upvotes · 0 comments - [Snowflake customers hit in data theft attacks after SaaS integrator breach](https://daily.dev/posts/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach-v9c1wyxhi) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#salesforce](https://daily.dev/tags/salesforce) [View this post on daily.dev](https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ShinyHunters claims yet another Salesforce customers breach","url":"https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi"},"datePublished":"2026-03-09T18:36:21.851Z","dateModified":"2026-03-11T11:53:07.636Z","description":"ShinyHunters claims to have stolen data from roughly 100 high-profile companies including Salesforce, Snowflake, Okta, LastPass, Sony, and AMD by exploiting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/442d1ac945623a8071bfcccaee2d4773?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/442d1ac945623a8071bfcccaee2d4773?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/shinyhunters-claims-yet-another-salesforce-customers-breach-zdm1mxqdi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,salesforce","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"ShinyHunters claims yet another Salesforce customers breach"}]} ```